kra46-at[.]farmaciait24[.]ru

The domain kra46-at.farmaciait24.ru was observed hosting a credential harvesting page titled “kra46 - AT фармацевтическая платформа для профессионалов”. The site was registered on 11 December 2024 through the Russian registrar REGRU‑RU and resolves to the IPv4 address 193.105.134.30, which belongs to AS42237 operated by w1n ltd in Sweden. No TLS certificate is presented, indicating that all traffic is served over plain HTTP. VirusTotal scans recorded 12 positive detections out of 95 submitted engines, and the domain appears on a single public blocklist that is also used by the PhishDestroy sinkhole, confirming active mitigation by at least one anti‑phishing service. The authoritative name servers are ns1.armadns.icu and ns2.armadns.icu, both of which are commonly associated with fast‑fluctuating malicious hosting.

Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification. The campaign is labelled as an investment scam, and the risk level has been set to elevated. The current operational status is offline, which may be a temporary takedown or a shift to another infrastructure. Defenders should continue to block the domain and its IP address at perimeter defenses, incorporate the observed name servers into DNS‑sinkhole rules, and add the IP 193.105.134.30 to reputation‑based blocklists.

Monitoring for re‑registration of the domain or the appearance of similar sub‑domains under the same registrar or hosting ASN is recommended. Because the site lacks TLS, any attempted connections can be detected via HTTP inspection. Organizations should also review any outbound traffic to the listed blocklist source to verify that existing phishing‑filtering solutions have already captured the indicator. Further intelligence gathering, such as passive DNS and WHOIS history, may reveal additional infrastructure used by the threat actor.